Writing to address based on offset?

Posts 1–15 of 22 · Page 1 of 2

I was wondering how to write to an address value based on offset value after getting the base address of a program?

For example I have this:

Code:

STARTUPINFO si = {0};
   PROCESS_INFORMATION pi = {0};
   if (CreateProcess(L"test.exe", NULL,NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL,  &si, &pi))
   {
   HANDLE processHandle = OpenProcess(PROCESS_VM_WRITE, FALSE, pi.dwProcessId);
      void (*ADDRESS) = (void*)0x402CB6;
      BYTE buffer[1] = {0xEB};     
   int lengthOfBuffer = 1;
   WriteProcessMemory(pi.hProcess, ADDRESS, buffer, lengthOfBuffer, 0);
   CloseHandle(processHandle);
   ResumeThread(pi.hThread);
}

But that's writing to a specific address. I'd like to get the base memory address of the program and then write the values to an address based on an offset.

Judging from your code your trying to write memory while outside the target process. Use Module32First & Module32Next to get the base address of the module you need the base address for.

MODULEENTRY32
Module32First
Module32Next

So something like this?

Code:

DWORD GetModuleBaseAddress( DWORD dwProcID, wchar_t* szModule )
{
MODULEENTRY32 xModule;
HANDLE hSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcID );
xModule.dwSize = sizeof( MODULEENTRY32 );
if( Module32First( hSnap, &xModule ) )
while( Module32Next( hSnap, &xModule ) )
if( wcscmp( xModule.szModule, szModule ) == 0 )
{
CloseHandle( hSnap );
return (DWORD)xModule.modBaseAddr;
}
CloseHandle( hSnap );
return 0;
}

int main()

{
	STARTUPINFO si = {0};
    PROCESS_INFORMATION pi = {0};
	if (CreateProcess(L"test.exe", NULL,NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL,  &si, &pi))
	{
		DWORD BaseAddress = GetModuleBaseAddress(pi.dwProcessId, L"test.exe");
		cout << BaseAddress << endl;
		ResumeThread(pi.hThread);
		Sleep(10000);
	}
	else cout<<"Error!"<<endl;
    return 0;

}

Although, it doesn't seem to be returning the base address. Its just returning 0

Yes, but you called Module32Next before even checking the first module's name. Meaning you're skipping the first module everytime, the first module is usually the executable module, so it's important you don't skip it.

Use a do while loop instead of a while to fix this.

I see many people making this same mistake for some reason. \:

Edit: Oh I didn't read the whole post, but what I just mentioned is the reason it's returning 0, it isn't finding the module 'test.exe' because you're skipping the first module in the loop.

like this?

Code:

DWORD GetModuleBaseAddress(DWORD iProcId, wchar_t* DLLName)
{
  HANDLE hSnap;
  MODULEENTRY32 xModule;
  hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, iProcId);
  xModule.dwSize = sizeof(MODULEENTRY32);
  if (Module32First(hSnap, &xModule))
  {
        if (wcscmp(xModule.szModule, DLLName) == 0)
        {
        CloseHandle(hSnap);
        return (DWORD)xModule.modBaseAddr;
        }
		else
		{	
		
		
			do{
				if (wcscmp(xModule.szModule, DLLName) == 0)
				 {
					 CloseHandle(hSnap);
					  return (DWORD)xModule.modBaseAddr;
			      }
				}
			while (Module32Next(hSnap, &xModule));
		}
  }
  CloseHandle(hSnap);
  return 0;
}

If that's what you meant, it's still returning 0.

http://www.mpgh.net/forum/31-c-c/220...retreiver.html

Uploaded it a while ago <3
~lilneo

'strcmp' : cannot convert parameter 1 from 'WCHAR [256]' to 'const char * <-- I get that error with your code. So i modified "char* modName" to "wchar_t* modName" and changed "strcmp" to "wcscmp", but when I use your function my program doesn't start it gives me an error: application failed to initialize properly (0xc0000142)

Originally Posted by lilneo

http://www.mpgh.net/forum/31-c-c/220...retreiver.html

Uploaded it a while ago <3
~lilneo

yeah, that would be exactly what I want, except for the fact that I need it to pick the exe by process id, not its name.

Sorry I took a while, I was lazily writing up some code for you.

This works perfectly for me.

[php]
#include <iostream>
#include <windows.h>
#include <tlhelp32.h>

using namespace std;

DWORD GetPID(char* procName)
{
HANDLE handle = CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
PROCESSENTRY32 procEnt;
procEnt.dwSize = sizeof( PROCESSENTRY32 );

Process32First(handle,&procEnt);
do {
if( strcmp(procEnt.szExeFile,procName) == 0 )
{
return procEnt.th32ProcessID;
}
}while( Process32Next(handle,&procEnt) );
return 0;
}

DWORD GetBaseAddr(DWORD pid,char* modName)
{
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL,pid);

MODULEENTRY32 modEnt;

modEnt.dwSize = sizeof( MODULEENTRY32 );

Module32First(snapshot,&modEnt);
do {
if(strcmp( modEnt.szModule,modName) == 0 )
{
return (DWORD)modEnt.modBaseAddr;
}
} while(Module32Next(snapshot,&modEnt));

return 0;
}

int main()
{

DWORD pid = GetPID("calc.exe");

DWORD base = GetBaseAddr(pid,"calc.exe");
cout << hex << base;
cin.get();
return 0;
}
[/php]

It successfully returned the base address of the module 'calc.exe', the executable module for Windows' Calculator.

I don't need get pid if I'm using create process and using pi.dwProcessId for the pid value right? because I want the PID from the process I'm creating.

Well then, take my function for the base address, and use your process id, and see what happens. If it still doesn't work, use my code or debug to find the problem. \:

Change the character set to using multi byte, then my code will work.

its working but i'm still getting that same error, "application failed to initialize properly (0xc0000142)". Is it the code, or possibly, the program itself?

Code:

STARTUPINFO si = {0};
    PROCESS_INFORMATION pi = {0};
	if (CreateProcess("test.exe", NULL,NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL,  &si, &pi))
	{
		DWORD BaseAddress = GetBaseAddr(pi.dwProcessId,"test.exe") ;
		cout << BaseAddress << endl;
		ResumeThread(pi.hThread);

		Sleep(10000);
	}
	else cout<<"Error"<<endl;
    return 0;

Never mind, about the program. It's definitely the code. Using that method, i still get the same error using windows calculator.

Did you read my post? T.T
~lilneo

Originally Posted by lilneo

Did you read my post? T.T
~lilneo

yes, did you read mine? Writing to address based on offset? - C++/C - MPGH - MultiPlayer Game Hacking

Originally Posted by Hell_Demon

How bout giving up making hacks untill you've learned the basics of C++?

Who said I was making a hack? I'm not making a hack. I just came here for C++ advice because you guys deal with this sort of stuff in C++ all the time. If you don't have anything useful to contribute to the topic, then how about just not post? I thought the whole purpose of this section of the forum was to help people with C++ and their lack of knowledge to help them learn. I'm not asking people to write code for me like void did, but he did and I thank him very much. I'm just asking people help point me in the right direction, and if I steer off path, help me get back on it.